TP-Link TL-MR3020

See also TL-MR3040 and TL-WR703N or TP-Link TL-MR10U, TP-Link TL-MR11U, TP-Link TL-MR12U and TP-Link TL-MR13UNote: Many of these routers are marketed as a "3G travel router" but none actually include a 3G modem - the marketing term rather means that the OEM firmware supports a certain range of 3G/4G modems to be externally connected to USB because it contains drivers for those USB modems! Ignore that, because with OpenWrt ANY router with USB supports 3G/4G hardware …

The router is powered through a mini-USB socket stub (5V) and comes with a USB power adapter.

Power consumption

Input voltage: The router will function correctly when powered with voltages as low as 3.3 Volts (determined experimentally) instead of 5V USB-Power. Thus, it can be powered directly from one single Li-Ion battery (which usually starts fully charged at 4.2V and has a nominal voltage of 3.7) without the need for an external 5V adapter.

This router is standardly powered via USB at 5V. The voltage regulators' input voltage should be at least between 3.7V - 5.5V, but not over 5.5V. The device will get damaged at too high voltages*. Maximum current draw at 5V is 255mA (Active Download + LAN + WLAN + USBboot), average current draw with WiFi is 125mA, idle is 68mA. Hence the average router power consumption is 0.6W, which is incredibly low.

Downgrade Attitute Adjustment from Trunk

Downgraded wrong image ( jff2 instead of squashfs ) cause cant get ip or connect to luci. Failsafe mode still working but firstboot command wont work because it is already on working. You can upload correct firmware and write it with mtd command but failsafe mode can't connect internet. You need to local tftp server to get firmware.

Set your pc ip 192.168.1.10/24 and gateway 192.168.1.1. Download mongoose http server and correct firmware same folder and start mongoose. It will host all files in his path ( if you start it from downloads folder it will host all files in downloads folder )

in case the file name of this firmware file does not contain the word "boot" in it, you can simply revert back to original firmware

in case the file name of this firmware file does contain the word "boot" in it, you need to cut off parts of the image file before flashing it:

An example of an image file with the word "boot" in it is mr3020nv1_en_3_17_2_up_boot(140408).bin.

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:

dd if=orig.bin of=tplink.bin skip=257 bs=512

You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well):

Via the safer method using sysupgrade:

sysupgrade /tmp/tplink.bin

Or you use the mtd method:

mtd -r write /tmp/tplink.bin firmware

It is also possible to revert to the stock firmware using the method with tftp described in "Manual Method Using Serial Console and TFTP (Experts)". (you still need the firmware images without the boot part).

OEM TP-Link firmware for the TL-MR3020 with the boot part removed to revert to the original OEM firmware:

Basic Configuration

Since this part is identical to the one recommended for generic devices, see Basic configuration.

Original Flash Layout

Please read the article Flash.Layout for a better understanding. It contains a couple of explanations. Then let's have a quick view at flash layout of this particular device:

TP-Link MR3020 Flash Layout stock firmware

Layer0

spi0.0: 4096KiB

Layer1

mtd0

mtd1

mtd2

mtd3

mtd4

Size in KiB

128KiB

1024KiB

2816 KiB

64KiB

64KiB

Name

u-boot

kernel

rootfs

config

art

mountpoint

none

none

/

none

none

filesystem

none

none

SquashFS

none

none

ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.

Hardware

Opening the Case

The case consists of two parts: a white base and a gray lid. The lid has two snap hinges, one right above the mini USB connector and one on the opposite side about 10 mm left of the "TP-LINK" logo. The lid is additionally glued in place on the underside on all four sides. You can try to pry it open with a thin but very stable blade tool. Start above the ethernet port where the case is not glued, and work your way around the glued corner towards the "3G USB" port (no glue there) until you reach the logo side. You should now be able to peek inside the case on the lose corner.

Next proceed along to the LED side, but beware of the fragile light conductors running straight down beneath the clear plastic. They easily bend or break when you push-in your tool too far. Once three sides are open, you can steadily lift the lid until the remaining side breaks lose and neatly frees the second hinge in the process. If you work carefully and manage not to break either one of the two hinges, the gray lid should snap neatly back into place after some manual cleaning with a cutter knife.

Warning!Be careful not to scratch PCB traces if you use a flat screwdriver to open the case.
Don't apply downwards pressure on the PCB itself with the tip of the screwdriver. Always point the tip of the screwdriver upwards, practicing a pressure from bottom to top.I just managed to practically kill an MR3020 because I scratched the ethernet port trace!

Serial Console

Pinout

1

2

3

4

TX

RX

GND

VCC

SJ1

Pin 1 is clearly marked on the board.

To get a reliable serial connection, you might have to connect a 10k pullup resistor between TX and VCC. This is because the TX pin is connected to a voltage divider (2x5.6k) and a capacitor is put between the real pin and the TX connector. Some serial adaptors might work without the pullup resistor (confirmed for one ST3232-based adaptor), but others definitely require it (confirmed for a FTDI FT232RL-based model).

If you are using a Linux or Mac system, the easiest way to connect to the serial console would be the screen command. It comes pre-installed on OS X, but must usually be installed on Linux systems. When installed, just type in a terminal:

screen /dev/[device name] 115200

where [device name] is the name of your serial adaptor, usually tty.usbserial* on Mac and ttyUSB* on Linux. To quit screen, press CTRL-a, followed by CTRL-k, followed by y.

U-Boot Bootloader Console

The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is displaying:

GPIOs

→ port.GPIO
The AR933x platform provides 30 GPIOs. Some of them are used by the router for status LEDs, buttons and other stuff. The table below shows the results of some investigation:

Voltage level at GPIO in output-mode

gpioX/value in input-mode when GPIO is:

GPIO

Common Name

PCB Name

gpioX/value=1

gpioX/value=0

Floating

Pulled to GND

Pulled to Vcc

0

WLAN LED

LED4

1

unknown. pulled high

R2

2

3

4

5

6

USB Power

R107

7

unused Pulled to ground

R15

8

USB power

R112

2.8V

9

10

11

WPS button

12

13

14

15

16

17

Ethernet LED

LED5

18

Sliding Sw.

19

20

Sliding Sw.

21

22

23

24

25

26

WPS LED

LED2

27

Internet LED

LED3

28

29

unused Pulled to ground

R17

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. "leds-gpio" and "gpio-buttons"). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.

Bootloader Mods

U-Boot 1.1.4 modification for routers

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future).

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

Version 3.0

The serial console is on the pad TP1 and TP2. TP2 is TX (console output) and TP1 is RX (keyboard input).

Hardware Hacks

Simple directional antenna

Swedish FreiFunk community Pjodd have a tutorial for how to put MR3020 in a small metall bowl from IKEA and weather proofing it for outdoor use in order to give the router a directional gain of what seems to be about 5 dBi, allowing for two such installations to communicate with each other at a distance of perhaps 1 km.

External Antenna Hack

If you want to add an external antenna connector or would like to know more about the MR3020 power consumption in different op-states you can find more info Apollo-NG MR3020 External Antenna Hack

External antenna output power

TL;DR: The signal dBm and signal distortion level sweetspot is somewhere between txpower 1000 and 1200.

Using region SE iw reg set SE, a 20MHz wide signal on channel 9, I measured the following output power from one of my TL-MR3020 with external antenna:

Signal dBm

Noise dB

txpower

-6

>41

100

-2

>41

500

0

>41

800

0.5

>41

900

2

1000

3

1200

6

35

1500

7

1800

7.5

28

2700

Where txpower was set using iw phy0 set txpower fixed n
and noise is the leaking distortion outside of the 20MHz signal bandwidth.

As a control I made a few measurements on a second TL-MR3020 with external antenna and got the following results:

Signal dBm

Noise dB

txpower

-2

>41

800

2

40

1200

4

36

1500

6

32

2600

The difference is rather small and probably due to soldering and possibly quality of analogue components on the PCB. Noise level is rather constant between the two tests though.

At the time of these tests the RP-SMA connectors was soldered on rather quick and dirty, and plenty of room was left between the connector and the PCB.

Image of not so well soldered connector

I've now cut the top side connector pins shorter and soldered the connector very close to the PCB instead, plus scratched up a bit more ground on the back side of the PCB, which I also soldered the back side connector ground pins to. Both for a better signal and to make it more sturdy. With some luck this can have increased the signal strength by 1dBm and lowered the signal distortion. Didn't measure again though, just seen that it works better with less noise and greater connection speed.

Image of RP-SMA connector with cut pins

Image of RP-SMA with cut pins soldered close to PCB

Image of backside of PCB scratch to get more ground. Notice that I've only scratched for one pin on this image. In the end I scratched for both legs and soldered them on there, visible in the next image.

Image of RP-SMA soldered also to ground of backside of PCB

Signal distortion

Is is very evident that the greater txpower, the greater amount of noise and distortion in the signal. The signal is very clear around txpower 800, while rather terrible when set to 1800 and more.

Image of analysis of the 20MHz signal at txpower 800

Image of analysis of the 20MHz signal at txpower 900

Image of analysis of the 20MHz signal at txpower 1200

Image of analysis of the 20MHz signal at txpower 1800

Image of analysis of the 20MHz signal at txpower 2700

Image of txpower 2700 is analyzed on a different rounter than the previous lower txpower images, mainly visible on the dBm and not the distortion.

Notice the amount of distortion outside of the 20MHz signal at 1800 compared to 1200 or 900. It is hard to say how much of this distortion is also available in the 20MHz signal, my guess is at least as much. This cripples the signal, making a greater txpower probably a worse signal with less speed than one without the distortion.

The txpower sweetspot is therefor estimated to be 1000-1200. This would equal a signal strength of 2-4dBm (1.5-2.5mW). To max that up to the common legal maximum of 100mW ERP you'll need an 18-21dBi antenna. You'll be much better of with a clean signal and a high gain antenna than attempting to crank up the signal strength to a level where it only cripple the signal with distortion.

Adding I2C Bus

If you want to add I2C bus to your MR3020, you can use GPIO 7 and 29. Remove R15 and R17, then add pullup between 3.3v and gpio pin.

GPIO Pinout

USB port and monitoring Serial Console via USB-Serial

The USB port on the TL-MR3020 is not compatible with USB devices that use low-speed (1.5Mbps) and only works properly with USB devices that use fast-speed (12Mbps) or high-speed (480Mbps). You can however plug a USB-Serial adapter as long as you plug that through a <$10 USB 2.0 hub that reports itself in dmesg as using high-speed (480Mbps); USB hubs that use fast-speed (even if they are marketed as USB 2.0) do not work in the TL-MR3020 when a low-speed device is connected in one of its ports. While you're at it, use another port of the USB hub to plug in a USB thumb drive and write data there (like serial console logs) so as not to wear out the built-in flash.

You can check if your device is using low, fast or high speed with dmesg command.